Preservation of Digital Evidence

There are procedures necessary for ensuring data in arson well preservation to ensure their admissibility in a court of law. I have various options for the preservation of data in hard drive found in an arson site. First, I need to take a photograph of the hard drive before retrieving the hard drive from the site. I will then take a photograph of the previous hard disk location before retrieval.

I will then mark the evidence by recording the time, location, my names, my initials, and the date of retrieving the data. I will also write a brief description of the evidence on the package by use of notes and sketches to ensure easy evidence identification. The next option available is to place the evidence in a special container for safekeeping, which is preferably a clean, unused, and airtight metal container. This will ensure the avoidance of unrestricted access, modification, compromise, or loss of evidence during the storage period (Nelson et al. 2010). Transportation of the evidence to a secure location is the next step I will take in ensuring the preservation of the hard disk evidence (Nelson et al.

2010). A securest option in this case is the Incident commander’s vehicle where I will keep the hard drive to preserve the data in the original state. On the arrival of the Investigator at the scene, I will transfer the hard drive from the Incident Commander’s vehicle to the investigator. I will also maintain a chain of custody, through documenting all the people who physically handled the evidence, from the period of retrieval to transfer to ensure maintenance of evidential integrity. This will aid in ensuring the evidence acceptance in a court of law and avoid inadmissibility of the data and dismissal of charges.

With the evidence safe with the investigator and a well-documented chain of custody, the evidence is well preserved and ready for analysis.